freeipa

#9996 ipatests: test_authselect.py fails on re-enroll after uninstall , host LDAP entry remains
Opened by pthube. Modified

Open
Close Issue

Issue

TestClientInstallation in ipatests/test_integration/test_authselect.py runs several install/uninstall cycles on the same client in one class. After ipa-client-install --uninstall, the client is removed locally but the host entry stays in LDAP on the master. A later ipa-client-install in the same class fails with "Host is already joined" (e.g. test_install_client_no_sudo).

Steps to Reproduce

1.Run test_integration/test_authselect.py.

Actual behavior

test_install_client_no_sudo fails:

Joining realm failed: Host is already joined.
Failed to obtain host TGT: ...
Installation failed.
ipa-client-install exits with code 1.

Expected behavior

The client must get uninstalled and the LDAP entry for that client must be removed for complete cleanup.

Additional info:

ipa-client-install --uninstall cleans up the client machine but does not delete the host object in IPA. That is expected in some cases (e.g. forced re-enrollment tests); see test_forced_client_reenrollment.py. For authselect tests, repeated enroll on the same hostname requires removing the stale host entry on the master.

Proposed fix
In test_authselect.py, after each uninstall, delete the client host on the master:
ipa host-del --updatedns

LOGS: https://$ARTIFACT_SERVER/idm-ci/freeipa/Nightly-Tier2/RHEL9.9/2026-05-11_16-00/tier-2/upstream-authselect/3/

Hi @pthube

the test test_install_client_no_sudo is executed right after test_uninstall_client_preconfigured_profile. If you look closely at the logs you can see the test_uninstall_client_preconfigured_profile has an undetected issue:

 -------------------------------Captured log call-------------------------------- 
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['ipa-client-install', '--uninstall', '-U']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:513 RUN ['ipa-client-install', '--uninstall', '-U']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Unenrolling client from IPA server
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Unenrolling host failed: cannot connect to 'ldapi://%2Frun%2Fslapd-TESTRELM-TEST.socket': 
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Removing Kerberos service principals from /etc/krb5.keytab
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Disabling client Kerberos and LDAP configurations
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Restoring client configuration files
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Restoring testrelm.test as NIS domain.
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 nscd daemon is not installed, skip configuration
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 nslcd daemon is not installed, skip configuration
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Systemwide CA database updated.
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 Client uninstall complete.
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:557 The ipa-client-install command was successful
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd38:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['cat', '/etc/authselect/authselect.conf']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd39:transport.py:513 RUN ['cat', '/etc/authselect/authselect.conf']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd39:transport.py:557 winbind
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd39:transport.py:557 with-fingerprint
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd39:transport.py:217 Exit code: 0

Note the error: Unenrolling host failed: cannot connect to 'ldapi://%2Frun%2Fslapd-TESTRELM-TEST.socket

The ipaclient-uninstall.log logs on the client show the following:

2026-05-18T06:59:44Z DEBUG args=['/usr/sbin/ipa-join', '--unenroll', '-h', 'client.testrelm.test', '-k', '/etc/krb5.keytab']
2026-05-18T06:59:44Z DEBUG Process finished, return code=1
2026-05-18T06:59:44Z DEBUG stdout=
2026-05-18T06:59:44Z DEBUG stderr=cannot connect to 'ldapi://%2Frun%2Fslapd-TESTRELM-TEST.socket': 
2026-05-18T06:59:44Z ERROR Unenrolling host failed: cannot connect to 'ldapi://%2Frun%2Fslapd-TESTRELM-TEST.socket':

It is this error that needs to be investigated.

Thanks @frenaud,

test_uninstall_client_preconfigured_profile only checks exit code 0 and authselect restore, so it misses that ipa-join --unenrol failed (cannot connect to 'ldapi://%2Frun%2Fslapd-TESTRELM-TEST.socket). Uninstall still reports success locally, but the host stays in LDAP, which is why test_install_client_no_sudo fails right after with Host is already joined.

I don’t think we should paper over this with ipa host-del in the test after uninstall ,that only removes a stale entry the prodct should have cleared. The real fix belongs on the product side: uninstall/unenroll should remove the host on the server, not leave LDAp state behind while returning 0.
Edited by pthube

Failed randomly as well on ipa-4-12 :
https:///idm-ci/freeipa_upstream_nightly/Nightly-latest-selinux/ipa-4-12/2026-05-14_20-02/latest/test_authconfig/1/report.html?sort=result
https:///idm-ci/freeipa_upstream_nightly/Nightly-latest-selinux/ipa-4-12/2026-03-19_19-55/latest/test_authconfig/1/report.html?sort=result
Metadata

test-failure

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.